[Security] Query string a=1 allows inclusion of any file in manager

A request like /manager/index.php?a=1&f=../processors/sample_processor_xyz allows backend users to bypass manager’s permission system and access processors directly.

A nice find, although if someone compromises the manager we have bigger issues most likely

Quite sure - still working through these many lines of code

Very nice NetNoise.

I also love the idea of using the [Security] tag before the message so we can readily identify the message

Just found two minor issues:

• $_COOKIE is written directly to db without checking (document.parser.inc.php)
• In login.processor.php htmlspecialchars is used to make posted username/password more secure. By default htmlspecialchars doesn’t mask single quotes, so there’s sql injection possible if magic_quotes are off.

BTW: There’s something wrong with unpublished documents - they are accessible via cache.

Shouldn’t that use mysql_escape_string or mysql_real_escape_string be used whenever dealing with the database?

That’s right. Anyway I hope this is one of the last sql-injection issues (There are some others, but they require a valid user to be logged in )